我正在用来wpa_supplicant设置 MACSEC 安全有线通道。在 Ubuntu x86 系统上，这是可行的。但在 Arm64 Alpine 系统上，MKA 似乎成功并且接口已设置，但没有 IP4 流量通过 MACSEC 链路。计数器InPktsNotValid上升。从驱动程序源代码来看，这意味着处理帧时内存分配失败或解密失败；不幸的是，司机接受了实际的错误。
wpa_supplicant所有涉及的系统上的配置文件都是相同的：
$ cat test.config
no_ctrl_interface=yes
eapol_version=3
ap_scan=0
fast_reauth=1
network={
key_mgmt=NONE
eapol_flags=0
macsec_policy=1
mka_cak=0123456789ABCDEF0123456789ABCDEF
mka_ckn=6162636465666768696A6B6C6D6E6F707172737475767778797A303132333435
mka_priority=128
}
我像这样运行 wpa_supplicant ：
sudo wpa_supplicant -ieth0 -Dmacsec_linux -ctest.config -d
以下是 wpa_supplicant 输出的示例：
KaY: to enpacket and send the MKPDU
*** MKA Basic Parameter set ***
Version.......: 1
Priority......: 128
KeySvr........: 1
MACSecDesired.: 1
MACSecCapable.: 2
Body Length...: 60
SCI MAC.......: d4:25:cc:b0:25:21
SCI Port .....: 1
Member Id.....: - hexdump(len=12): ea fd 2f b9 9d f6 e2 17 38 0d d8 b1
Message Number: 34069
Algo Agility..: - hexdump(len=4): 00 80 c2 01
CAK Name......: - hexdump_ascii(len=32):
61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 abcdefghijklmnop
71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 qrstuvwxyz012345
*** Live Peer List ***
Body Length...: 16
Member Id.....: - hexdump_ascii(len=12):
9a fa 89 4d b4 3a 6b ac 2f b9 61 52 ___M_:k_/_aR
Message Number: 34451
macsec_linux: macsec_drv_get_receive_lowest_pn
macsec_linux: macsec_drv_get_receive_lowest_pn: result 1
*** MACsec SAK Use ***
Latest Key AN....: 0
Latest Key Tx....: Yes
Latest Key Rx....: Yes
Old Key AN....: 0
Old Key Tx....: No
Old Key Rx....: No
Plain Key Tx....: No
Plain Key Rx....: No
Delay Protect....: No
Body Length......: 40
Key Server MI....: - hexdump(len=12): ea fd 2f b9 9d f6 e2 17 38 0d d8 b1
Key Number.......: 1
Lowest PN........: 1
Old Key Server MI....: - hexdump_ascii(len=12):
00 00 00 00 00 00 00 00 00 00 00 00 ____________
Old Key Number.......: 0
Old Lowest PN........: 1
l2_packet_receive: src=d4:25:cc:b0:79:81 len=152
eth0_bridge: RX EAPOL from d4:25:cc:b0:79:81
RX EAPOL - hexdump(len=152): 03 05 00 94 01 80 60 3c d4 25 cc b0 79 81 00 01 9a fa 89 4d b4 3a 6b ac 2f b9 61 52 00 00 86 94 00 80 c2 01 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 01 00 00 10 ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 00 00 85 14 03 34 00 28 ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ff 00 00 10 f7 7c bc 50 24 8b bb af b0 c3 95 bc 29 ec 8c c5
eth0_bridge: Ignored received EAPOL frame since no key management is configured
l2_packet_receive: src=d4:25:cc:b0:79:81 len=166
RX EAPOL-MKA: - hexdump(len=166): 01 68 76 68 76 68 d4 25 cc b0 79 81 5e ea 03 05 00 94 01 80 60 3c d4 25 cc b0 79 81 00 01 9a fa 89 4d b4 3a 6b ac 2f b9 61 52 00 00 86 94 00 80 c2 01 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 01 00 00 10 ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 00 00 85 14 03 34 00 28 ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ff 00 00 10 f7 7c bc 50 24 8b bb af b0 c3 95 bc 29 ec 8c c5
*** MKA Basic Parameter set ***
Version.......: 1
Priority......: 128
KeySvr........: 0
MACSecDesired.: 1
MACSecCapable.: 2
Body Length...: 60
SCI MAC.......: d4:25:cc:b0:79:81
SCI Port .....: 1
Member Id.....: - hexdump(len=12): 9a fa 89 4d b4 3a 6b ac 2f b9 61 52
Message Number: 34452
Algo Agility..: - hexdump(len=4): 00 80 c2 01
CAK Name......: - hexdump_ascii(len=32):
61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 abcdefghijklmnop
71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 qrstuvwxyz012345
*** Live Peer List ***
Body Length...: 16
Member Id.....: - hexdump_ascii(len=12):
ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 __/_____8___
Message Number: 34068
*** MACsec SAK Use ***
Latest Key AN....: 0
Latest Key Tx....: Yes
Latest Key Rx....: Yes
Old Key AN....: 1
Old Key Tx....: No
Old Key Rx....: No
Plain Key Tx....: No
Plain Key Rx....: No
Delay Protect....: No
Body Length......: 40
Key Server MI....: - hexdump(len=12): ea fd 2f b9 9d f6 e2 17 38 0d d8 b1
Key Number.......: 1
Lowest PN........: 1
Old Key Server MI....: - hexdump_ascii(len=12):
00 00 00 00 00 00 00 00 00 00 00 00 ____________
Old Key Number.......: 0
Old Lowest PN........: 1
macsec_drv_get_transmit_next_pn
macsec_linux: macsec_drv_get_transmit_next_pn: err 0 result 50789
KaY: to enpacket and send the MKPDU
*** MKA Basic Parameter set ***
Version.......: 1
Priority......: 128
KeySvr........: 1
MACSecDesired.: 1
MACSecCapable.: 2
Body Length...: 60
SCI MAC.......: d4:25:cc:b0:25:21
SCI Port .....: 1
Member Id.....: - hexdump(len=12): ea fd 2f b9 9d f6 e2 17 38 0d d8 b1
Message Number: 34070
Algo Agility..: - hexdump(len=4): 00 80 c2 01
CAK Name......: - hexdump_ascii(len=32):
61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 abcdefghijklmnop
71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 qrstuvwxyz012345
*** Live Peer List ***
Body Length...: 16
Member Id.....: - hexdump_ascii(len=12):
9a fa 89 4d b4 3a 6b ac 2f b9 61 52 ___M_:k_/_aR
Message Number: 34452
macsec_linux: macsec_drv_get_receive_lowest_pn
macsec_linux: macsec_drv_get_receive_lowest_pn: result 1
*** MACsec SAK Use ***
Latest Key AN....: 0
Latest Key Tx....: Yes
Latest Key Rx....: Yes
Old Key AN....: 0
Old Key Tx....: No
Old Key Rx....: No
Plain Key Tx....: No
Plain Key Rx....: No
Delay Protect....: No
Body Length......: 40
Key Server MI....: - hexdump(len=12): ea fd 2f b9 9d f6 e2 17 38 0d d8 b1
Key Number.......: 1
Lowest PN........: 1
Old Key Server MI....: - hexdump_ascii(len=12):
00 00 00 00 00 00 00 00 00 00 00 00 ____________
Old Key Number.......: 0
Old Lowest PN........: 1
l2_packet_receive: src=d4:25:cc:b0:79:81 len=152
eth0_bridge: RX EAPOL from d4:25:cc:b0:79:81
RX EAPOL - hexdump(len=152): 03 05 00 94 01 80 60 3c d4 25 cc b0 79 81 00 01 9a fa 89 4d b4 3a 6b ac 2f b9 61 52 00 00 86 95 00 80 c2 01 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 01 00 00 10 ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 00 00 85 15 03 34 00 28 ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ff 00 00 10 f4 41 37 ff d5 59 6f 95 c6 3f 16 5a 9a 21 c6 b4
eth0_bridge: Ignored received EAPOL frame since no key management is configured
l2_packet_receive: src=d4:25:cc:b0:79:81 len=166
RX EAPOL-MKA: - hexdump(len=166): 01 68 76 68 76 68 d4 25 cc b0 79 81 5e ea 03 05 00 94 01 80 60 3c d4 25 cc b0 79 81 00 01 9a fa 89 4d b4 3a 6b ac 2f b9 61 52 00 00 86 95 00 80 c2 01 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 01 00 00 10 ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 00 00 85 15 03 34 00 28 ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ff 00 00 10 f4 41 37 ff d5 59 6f 95 c6 3f 16 5a 9a 21 c6 b4
*** MKA Basic Parameter set ***
Version.......: 1
Priority......: 128
KeySvr........: 0
MACSecDesired.: 1
MACSecCapable.: 2
Body Length...: 60
SCI MAC.......: d4:25:cc:b0:79:81
SCI Port .....: 1
Member Id.....: - hexdump(len=12): 9a fa 89 4d b4 3a 6b ac 2f b9 61 52
Message Number: 34453
Algo Agility..: - hexdump(len=4): 00 80 c2 01
CAK Name......: - hexdump_ascii(len=32):
61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 abcdefghijklmnop
71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 qrstuvwxyz012345
*** Live Peer List ***
Body Length...: 16
Member Id.....: - hexdump_ascii(len=12):
ea fd 2f b9 9d f6 e2 17 38 0d d8 b1 __/_____8___
Message Number: 34069
*** MACsec SAK Use ***
Latest Key AN....: 0
Latest Key Tx....: Yes
Latest Key Rx....: Yes
Old Key AN....: 1
Old Key Tx....: No
Old Key Rx....: No
Plain Key Tx....: No
Plain Key Rx....: No
Delay Protect....: No
Body Length......: 40
Key Server MI....: - hexdump(len=12): ea fd 2f b9 9d f6 e2 17 38 0d d8 b1
Key Number.......: 1
Lowest PN........: 1
Old Key Server MI....: - hexdump_ascii(len=12):
00 00 00 00 00 00 00 00 00 00 00 00 ____________
Old Key Number.......: 0
Old Lowest PN........: 1
macsec_drv_get_transmit_next_pn
macsec_linux: macsec_drv_get_transmit_next_pn: err 0 result 50790
这是一个示例ip -s macsec show：
$ ip -s macsec show macsec0
38: macsec0: protect on validate strict sc on sa on encrypt on send_sci on end_station off scb off replay off
cipher suite: GCM-AES-128, using ICV length 16
TXSC: d425ccb079810001 on SA 1
stats: OutPktsUntagged InPktsUntagged OutPktsTooLong InPktsNoTag InPktsBadTag InPktsUnknownSCI InPktsNoSCI InPktsOverrun
0 0 0 1112 0 0 2 0
stats: OutPktsProtected OutPktsEncrypted OutOctetsProtected OutOctetsEncrypted
0 7 0 962
1: PN 8, state on, key 4c9085d6632af3e66b5ea34602000000
stats: OutPktsProtected OutPktsEncrypted
0 7
RXSC: d425ccb025210001, state on
stats: InOctetsValidated InOctetsDecrypted InPktsUnchecked InPktsDelayed InPktsOK InPktsInvalid InPktsLate InPktsNotValid InPktsNotUsingSA InPktsUnusedSA
0 18722 0 0 0 0 0 253 0 0
1: PN 1, state on, key 4c9085d6632af3e66b5ea34602000000
stats: InPktsOK InPktsInvalid InPktsNotValid InPktsNotUsingSA InPktsUnusedSA
0 0 0 0 0
内核有CONFIG_MACSEC=y、CONFIG_CRYPTO_GCM=y和CONFIG_CRYPTO_AES=y。
这还能出什么问题吗？
答案1
事实证明，这是 Linux 4.9 中的一个错误，b3bdc3acbb44d74d0b7ba4d97169577a2b46dc88已在进入4.10-rc9或附近的提交中修复。如果 MACSEC 驱动程序不阻止解密帧而是异步接收解密的帧，则即使解密成功，驱动程序也始终将帧标记为无效。